@EvanAnderson Oh come on, even I've asked questions sometimes!

I'll bet @EvanAnderson deletes them once he got his answer.

He's sneaky like that.

@ScottPack Ha, no, I cheated and looked. @EvanAnderson has actually never asked a question at all. I'm not sure whether to be impressed or horrified.

Don't be so closed minded.

I'm a SF moderator. I have to be close minded.

Yup, they said so on hackernews, so you know it's true

What did they say about me on HN? I forgot already.

@EvanAnderson That's fair, and impressive, but I'm with @MichaelHampton on that one.

Yeah, me too. It was something about you being an asshole for answering too many questions, or some shit.

Oh yeah, I am a jerk because I called somebody's ancient crusty homegrown CMS a nightmare pile of spaghetti code and said the developer had probably never even heard of design patterns.

Yeah, that sounds right. I remember something about pasta.

@MichaelHampton Hope it was during an HB shakedown.

@BigHomie Yes, I was grepping old logs for SSL related stuff at the time.

Woah. womble seen yesterday

Oh man that was a rough day.

Yay!

@MichaelHampton Where is that test from?

@MarkHenderson ssllabs.com/ssltest/index.html

@PatoSáinz It responds: "Why on earth would you post it here? Now it's surely not."

@MichaelHampton Wow, that test is pretty hardcore in its scoring

I got two immediate fails

@MarkHenderson You can find the winning config here: community.qualys.com/blogs/securitylabs/2013/08/05/…

Though that config breaks IE 6, Java 6 and Yandex...

We're stuck on IIS7 for the time being, so I guess I won't be getting anything better than an F for a long time

I don't give a fuck about IE 6, Java 6 or Yandex. The two former are bullshit or malicious traffic at my sites, the latter is just pointless.

Security is hard.

Ehh...the real complexity comes from having to maintain backward compatibility with all that obsolete shit everyone's got in their datacenters and workstations.

@MarkHenderson Even on IIS7 you ought to be able to improve matters.

@MichaelHampton Well there isn't a patch for their insecure renegotional as far as I can tell

But I ahve on my roadmap a haproxy box that will also do SSL termination, so when I implement that I will get a chance to fix some things

@MarkHenderson There's a workaround but to implement it you have to disable client certificates entirely, which may not be what you want.

@MichaelHampton Interesting

I might have to do a test on our staging system to see

@MarkHenderson You can also disable SSLv2 with a registry hack

@MichaelHampton JAVA MUST DIEEEEEEEEEE

@MichaelHampton We support legacy devices, back to WM6 so I will need to check if that's going to fuck anything up for them

@MarkHenderson Windows Mobile 6 should do SSLv3 and TLS1.0

Even WM5 supports TLS 1.0

technet.microsoft.com/en-us/library/cc182301.aspx

Oh good

Hm, I think I have an old WM6 phone in the junkbox...

Sadly I have one charging on the desk next to me

I fucking hate it

I hate it so badly

Found it. Charger doesn't seem to be working though...hmmm.

Oh wow, TWO of them. And another charger...

Just switched back to Chrome. I can't take Firefox's memory leaks anymore....

@PatoSáinz huh?

@PatoSáinz You seem to be out against everything....

@PatoSáinz Well, if it wasn't a bottomless memory bucket I would use it.

@MichaelHampton Oh gross

I think I just threw up a little

@MichaelHampton Dude, was that like under the floor?

@PatoSáinz 5-15

But I have plenty of memory

Woah. No Wi-Fi at all.

@Jacob I said it was in my junkbox!

@MichaelHampton My wife had a Pocket PC circa 2003 as well. HP Somethingorother. No Wifi, but had a CF slot you could get a WiFi adapter for.

@PatoSáinz I have no idea then... I can't run it on 12 and 16GBs.

@Jacob Firefox is not a bottomless memory bucket. It's limited to the amount of memory in your system.

@MarkHenderson I had a palm pilot.

@MarkHenderson Yeah, there's a monster slot on the side of this beast.

OK, let's try the other phone...

@Jacob My Dad was a Palm fan. He had the palm script notation fluent

@PatoSáinz Why would you want to do that?

Who wants to tweak their browser?

You totally run Gentoo, don't you?

@MarkHenderson except I have real work to get done...

@MarkHenderson arch is the new gentoo. Come on, keep up.

Gah. I always feel so childish when I put off and put off and put off a bug because it looks spiteful to fix, and eventually after accepting it and starting it, it's a tiny 5 minute fix that I could have done two weeks ago.

@PatoSáinz That's like saying you ride a unicycle to work because you're too lazy to take the bus.

@tylerl This is truth.

@tylerl Does the bus break down all the time and require the passengers on the bus to get out and push?

@PatoSáinz Wait. Let me get this straight. You just told me to tweak my browser, but you don't want to fix your linux again?

Dude, you're nuts.

Anyway, I just wanted to say that .NET is the Devil, and ASP is his angel.

@MarkHenderson I've DONE that! In Sicily. Everybody acted like it was so normal. I was flabbergasted.

They were like "everybody out, let's push-start this thing", so we all got out while the driver popped the clutch.

@tylerl Italians! (/Mediterraneans)

Grr. How do you iterate over the values of a config section in a web.config file?

goddam asp.net.

Wow, your Heartbleed question has 15kviews @Jacob

Nice work

@MarkHenderson I noticed thanks, and it has a close vote for some reason.

@MarkHenderson Nah, the credit goes to the people who wrote the answers.

@Jacob Someone voted as "too broad"

Yeah but you get plenty of rep + a gold badge

I was going to write one, but everything I was going to say has already been said.

@MarkHenderson My SU post is what I'm really proud of.

@MarkHenderson The Sec.SE people are more than exhausted w/ heartbleed. It's so much hype and has lead to SOO many horrible questions.

Should I change my uncle's pacemaker battery because of heartbleed?

Is heartbleed dangerous to squirrels?

Do I need to change my social security number because of heartbleed?

@tylerl I bet

My browser is slow. Have I been hacked by heartbleed?

@tylerl I don't even think you can be issued a new SSN except under extreme circumstances.

@tylerl My wife left me. How can I tell if she used Heartbleed to find out that i'm into gay midget porn?

@MarkHenderson When is she due?

@Jacob 7 days

Last baby was a lazy motherfucker and ran a week late

We're hoping this one sticks to the schedule

@MarkHenderson lordy what a joyful world you will be living in come this time next month.

soo much sleep

@MarkHenderson I was three months early and my mom nearly died.

@Jacob What is this? A competition?

@MarkHenderson Don't complain about your kid being late.

@tylerl I know. My wife and I were just discussing the other day how we must be really, really stupid to do this again

@Jacob I'll complain about whatever I want. I will also complain about being hungry even though kids in Africa are starving to death, I will complain about not having any money even though I own two cars making me richer than most of the rest of the world, and I will complain about how shitty my internet is even though large parts of the world can't even access sanitary drinking water.

@MarkHenderson Your internet really does suck.

I'd have to buy like 6 ADSL connections to equal what I have here.

@Jacob Good luck trunking them together

@PatoSáinz No because as much as I'd like to be asleep it's not even midday

@MarkHenderson Why? I'd just get gear colo'ed at Equinix.

@PatoSáinz Oh no it's not either.

@tylerl Oh... well, fuck me. I just added a Heartbleed question. But seriously, is heartbleed only a threat if my servers have hearts in them? I took all the body parts out of my servers a whole ago.

@Jacob And you'll move into Equinix so you can have those speeds from your bedroom?

@MarkHenderson Why do I have to move to Equinix

@Jacob Never mind

@MarkHenderson Am I missing something?

@HopelessN00b Well, it's a well-known fact that all servers have hearts. Otherwise they could never learn to love.

If I hear another word about this bug I will register new accounts, and get them enough rep to downvote your questions until you are at 1 rep.

@FalconMomot :(

Don't think it's a horrible question, but having read your comment I probably would have left the heartbleed tag out. Figure a lot of you have to have the tag ignored, now that I think about it.

bahah @andrew @bob

gizmodo.com.au/2014/04/…

patch your servers and get done grousing.

:p

Get registering accounts, @FalconMomot. Gonna have to do a lot of downvoting to get rid of all my rep.

@MarkHenderson So they are pretty much saying that you can't afford it anyway because it's the Ferrari of content?

debating whether to downvote that post

@Jacob Yah

@MarkHenderson Do you have to pay alot for the channel or something?

@Jacob Foxtel is about a $70/month minimum commitment if you want to get the channel that GoT is on

I actually have Foxtel Play, their IPTV offering, courtesty of my brother, but its max resolution is 480i. Which sucks balls.

@MarkHenderson That's INSANE. I think we get HBO for ~5$ Why is it so expensive?

@Jacob BECAUSE EVERYTHING HERE IS EXPENSIVE

Because they are the ONLY Pay TV operator

Because they own all the infrastructure

And the own the government

@MarkHenderson Even TV?

And the own the sector

@Jacob TV is actually free. Plenty to choose from on the DTV spectrum.

$70 a month for 480i streaming is insanely poor value.

but I guess they still win if people pay it.

But if Foxtel signs up an exclusive deal, then none of the Free To Air channels can get it

@FalconMomot You only need 265 question downvotes to get me to 1 rep on sec.SE. Get a crackin'!

@FalconMomot Nah the streaming serbice is about $35/month so it is cheaper

The full-service cable is $75/month

@MarkHenderson And they have the most revenue to offer the highest bid

@HopelessN00b It might actually be easier to track you down and cook your pets.

@Jacob Well, I don't know about that. I don't really keep up with how much money the TV stations make as I would never invest in them. They would be terrible investments.

I am going to breed some dragons, and train them to harass you.

Now I know why your internet is so slow. You all are trying to get the GoT episode.

@FalconMomot I has no pets. So the dragon idea is definitely the better of the two.

Seriously, A fight between @FalconMomot and @HopelessN00b is popcorn worthy.

@Jacob We are the biggest piraters, per capita, of GoT

And most other good American shows for that matter

@Jacob I should train the dragons to make me popcorn!

Damn piece of shit Windows phone will not even connect to the open WiFi...

@MarkHenderson America has good TV shows? All of my favorite ones ended.

@MichaelHampton issue it to @HopelessN00b!

Though Archer is pretty funny.

@Jacob Nah, lookit that face! How could I stay mad at it when all I really want to do is pet his Mohawk?

@FalconMomot How's that ops position coming?

@Jacob having spent the last 3 days beating up crap in EC2

I have been lobbying for it pretty hard

@Jacob Game of Thrones for one

@FalconMomot Call me when you do get it :)

@Jacob you could apply to be our sysadmin today.

Walking Dead is mediocre but better than anything produced locally

@MarkHenderson You said show**s**

The Americans is pretty good

it's not hard to commandeer the sysadmin to do ops for an internal project.

@FalconMomot not sure I fit all the requirements for that.

! how?!

And we broke records for the final season of Breaking Bad

Hah this comment sums it up nicely:

> It's a lot like trying to buy a Ferrari and being told you can't buy it outright, you can only rent. And not by itself, you have to pay for an entire fleet of economy shitbox cars you don't want and will never drive, the cost of which takes the monthly price to about quadruple the price of buying a single new ferrari outright, Also only 3 named people can be a passengers, and only 2 of those at a time.

don't know how to use xen or something?

@MarkHenderson lol nice

@FalconMomot Actually I might.

Just relooked at it.

That, or this comment:

> Telstra and murdoch can share a bag of dicks

@Jacob I sure hope you do.

most of the requirements are soft and not stated there though

like

be sane and flexible and live in seattle

@FalconMomot relocation?

and be security-minded

hmm, I don't know if they'd pay for relocation or not. maybe.

@FalconMomot I meet that much.

you know what to do then.

@FalconMomot Fucking hell. I am getting so sick of that requirement!! If everyone keeps requiring sanity from their employment candidates, I'm never gonna get a new job. >:/

@HopelessN00b there was this one time we hired Hitler and we had to let him go. Never again.

Xen is wacky

@FalconMomot I'd have to write up my resume again. The one not on careers is terrible, and a cover letter. I'll strongly consider it if you think I have a chance.

Oh, I found a Palm in the junkbox too...

@FalconMomot Oh, no, no, no. I'm more the fun, strange, showing-up-at-work-naked-because-my-pants-were-talking-to-me kind of crazy, not the invade-Europe-and-kill-a-bunch-of-Jews crazy.

@Jacob I'll know if you have a chance once I see your CV :P

@HopelessN00b it's fine to do that as long as you work from home that day...

@FalconMomot I'm actually considering that. We'll see.

@tylerl sweet.

@FalconMomot Is Seattle really that good?

@tylerl yes, if you're a hacker. I'm trying to move there from Calgary.

@FalconMomot careers.stackoverflow.com/jacobjernigan

@FalconMomot How about Kirkland?

That needs updating too

@FalconMomot I make up for it by being a fast learner, though. Only had to be fired 4 times for waving my pickle around the office before I put it together that being naked at work was what was getting me fired.

fuck

@Jacob hmm maybe? as long as you can talk about xen and exchange and linux, and your experience is solid.

back to fucking with ADFS

AD password policies are fucking retarded

@tylerl we have staff that commute from bainsbridge island...

@FalconMomot Like plain xen or XS? Though I've worked with both

@Jacob I think it's plain xen.

@Bob What password policies aren't retarded, though?

@HopelessN00b Hitachi ID has a good grip on it.

minimum age is a load of shit. complexity needs to be variable.

@FalconMomot No, I mean the office is in Kirkland.

Though apparently the team sometimes works out of the office in Seattle proper.

@tylerl whose office?

It's a pretty relaxed company, from what I hear.

mine is in seattle

@FalconMomot Google.

Turns out attempting to change a password actually checks against a cached value and doesn't increment the bad password attempts :(

@tylerl I actually passed them up recently

Therefore, you can bypass account lockout just by hitting the password change

@FalconMomot why's that?

who the fuck decided that was a good idea

@FalconMomot Yup, and yup. Of course, no minimum age and users will just change their password until they can change it back t what it's been for the past 8 years.

@FalconMomot What do you mean and?

@tylerl because I make what they wanted to pay me, and I can work from home infinitely, pick my own hours, and arbitrarily move to any city I want.

@Jacob all possible meanings except running exchange on linux?

@FalconMomot I've worked with Windows, and exchange.

@HopelessN00b yeah, so you say "not used in the past x days"

@Jacob might want to feign some linux experience then.

@FalconMomot Exchange on Linux???

@Jacob no. don't do that. it's a sin.

@FalconMomot I was confused. Since when is Exchange usable on Linux

@FalconMomot I hear Wine can run most viruses. I imagine that includes Exchange.

@FalconMomot Yeah, hat would be the better approach. We just remember the last 43 passwords used. <sigh>

@tylerl missing verb...

@Jacob never. that's why I excluded it.

@FalconMomot verbed

@tylerl :) I feel the same way.

Just cloud it!

@HopelessN00b yeah HiPM remembers hashes of them forever by default (you can purge them after a time if you like) and lets you specify "not used within the past X days", you can change X whenever as long as you have history, and it integrates with AD to enforce this password through the windows password change box.

it's sweet.

I don't work for them anymore and haven't for a year but I still think it's a solid product for about 99999 reasons.

@Jacob Pick up the RHCE literature and spin up some CentOS VMs. Linux guys make it sound hard, but I've been running a bunch of Linux VMs, and only accidentally destroy one of them every other day or so.

kind of expensive but the SSPR makes up for it in reduced helpdesk load I think

@HopelessN00b I use CentOS :)

@HopelessN00b linux isn't hard at all.

rm -rf / --explicit-permission-to-kill-kittens-enabled

@FalconMomot Yeah, sounds slick, and half our tickets are password related. The other half are printer related, but there's no cure to that, except fire. Fire will cleanse the printers.

@HopelessN00b you should seriously consider evaluating it if you wield that kind of power.

@HopelessN00b you've only accidentally destoryed one? You better pick up the pace. By the time I was even remotely decent at Linux admin work, I'd destroyed enough servers to fill a shipping container.

@tylerl dude my first linux server is still operational to this day.

I think it was built on may 8th, 2005...

@FalconMomot I'm starting out slow, with that secret server password management system Jacob likes. CIO is doing a full security review, so there might be budget for an H-ID setup, but if I'm still there by the time that comes around, I might decide sepuku is the appropriate remedy.

My first Linux server was broken into by a rogue employee of the DC...

@FalconMomot My first linux server ran on a 100Mhz Pentium. Back when that was new.

@tylerl Missed the next part of that. "accidentally destroy one of them every other day or so"

@HopelessN00b you can usually evaluate it for free and if you're just doing AD it's turnkey. Install MSSQL server, run the installer, configure like 3 options, and you're good to go in dev.

@tylerl yeah mine was on one of those original 1GHz AMD processors

@HopelessN00b ah. Well, keep up the good work, son. Mess with GRUB a bit tell you got the hang of it. You typically go through several installations a day when you're learning how the boot process works.

I still have a box that uses lilo.

I hear there's some guy out there who still intentionally uses lilo.

@tylerl Oh, yeah... when I was young, dumber and... foolish-er, I got a lot of experience with GRUB when I was doing Gentoo.

@HopelessN00b try this one out: Recovering from a Broken Partition Table. Once you can rebuild a partition table by hand using information you gleaned form nothing but a hex dump, then you feel like you've accomplished something.

(I wrote that up after doing exactly this on a client's server)

@tylerl Oh dear God. That sounds like a dangerous skill to have. If anyone found out I could do it... I might be asked to do it. Too risky for my taste.

@tylerl I hope you billed a lot for that magic right there.

@Jacob It's a dark art.

@tylerl That better have brought you money

@Jacob Lots.

Yeah, that is pretty impressive work, I gotta say.

@tylerl Good, because that looks like a lot of fun.

@Jacob There are several dozen admins who have admitted to me that they owe me for their continued employment at $COMPANY. You get a fair list of allies pretty quick.

Thing is, once you understand how it all works, stuff like that isn't really magic, it's just math. That's my point about breaking servers. Do it lots.

@tylerl Yeah, that's how I've gotten to where I am.

...and yet here I am writing a goddam web service in C#. Using Microsoft products makes you feel like your life has gone horribly wrong.

@tylerl breaking things is absolutely the best way to learn

@tylerl Only when they don't work. When they do, it makes you feel like you're getting paid to surf the web and pursue your interests.

@MichaelHampton I had that as an interview question 2 years ago... "What happens when you try to boot your server and all you get is LI- ??"

@ewwhite "you swear and go grab the backup tapes?"

@ewwhite I go to Google and check the error codes in the LILO documentation. Then I curse a lot because there's still antique hardware in production...

@ewwhite That brings back grins.

Pentium III!!!

Oh, it's repairable with an equally antique Live CD.

Assuming the problem isn't that the hard drive has died.

And once it's booted, I'll fix everything up in Linuxconf.

I remember really resisting switching to grub. But then when I learned it had the interactive boot console where you could repair your configuration on-the-fly.... that sold me right there.

@tylerl Ha, wait until you see GRUB 2.

I think you can probably start a nuclear war from GRUB 2's interactive prompt.

@PatoSáinz grub2 really kicks it up a notch. Both in capability and complexity

Lots more features, better handling of large hard drives, booting from ZFS and many more filesystems...

turing-complete configuration language

you can now mine bitcoins from your boot prompt

pedant

@PatoSáinz POSTSCRIPT!

@MichaelHampton NOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO.

Not Skynet composed of PRINTERS I mean regular skynet would be ok, but PRINTERS!!

@MichaelHampton How is that possible?

@Jacob How can an HP printer initiate the robot uprising?